Directory listing enabled

Folders the server lists the contents of instead of refusing. Everything ever uploaded there is browsable by anyone who guesses the path.

• Help center

When a folder has no index file, many servers generate a page listing everything inside it — Apache with Options +Indexes, nginx with autoindex on. That turns an uploads or assets folder into a browsable catalogue: old exports, invoices, drafts and anything else ever placed there but never linked. Search engines can index such listings too, so the files may surface in search results.

How SiteScan checks

During the crawl, the scan notes a folder that the site's own images, scripts or stylesheets are served from (for example /wp-content/uploads/2024/05/ or /assets/) and requests that folder address directly. If the answer is a 200 whose page title begins with "Index of" or "Directory listing for" — the titles Apache, nginx and most built-in servers use — the row turns red and names the folder. A 403, a 404 or an ordinary page means the server declined, and the row reads "Nothing found". Only one folder is probed, so a clean result does not prove that every folder is closed.

How to fix it

Switch listings off globally: Options -Indexes in Apache or .htaccess, autoindex off; in nginx (its default). An empty index.html in the folder also works. Then review what was reachable and remove anything sensitive — see files left behind.